System and Method of Protecting A Network

ABSTRACT

There is provided a network appliance, methods and systems which intercept web and email traffic, extract executables, compare the executables with a policy and wrap the executables. Then, the wrapped executables are delivered to a client system in a manner to protect the network and end point devices, where the wrapped executables are run in a sandbox with all file system, registry accesses, communication and traffic isolated.

CROSS REFERENCE TO RELATED APPLICATIONS

This Application claims priority from U.S. Provisional Application No.62/061,403 filed on Oct. 8, 2014 and U.S. Non-provisional applicationSer. No. 14/877,402 filed on Oct. 7, 2015 which is incorporated hereinby reference in its entirety.

This invention relates to the field of cyber security and moreparticularly to the delivery of executable files in a secure manner to aclient endpoint in order to protect a network.

BACKGROUND

Traditional signature-based security solutions cannot defend againstZero-day and Advanced Persistent Threat (APT) attacks effectively. As aresult, some vendors are now providing an appliance based solution.These solutions run threats in a virtual machine in an appliance, thenthe solution analyzes the threats in signature-less, behavior based way.There are, however, numerous drawbacks of a virtual machine basedappliance. First, all threats are executed and analyzed in theappliance, which makes the appliance the performance bottle neck.Second, virtual machine based analysis can be bypassed easily by virtualmachine detection and malware may behave differently when running in avirtual machine versus a physical machine. Third, users have to waituntil analysis completes before they can actually use these executablefiles on their client systems. Fourth, some threats may infect a systemwith a delay of time, even after several hours—a virtual machine basedappliance cannot detect the threats in this case. Additionally, when ananalyzer fails to detect a threat, the threat will compromise the clientsystem directly.

There is a need therefore, to overcome these and other drawbacks so thatthreats may be eliminated and executable files delivered in an effectivemanner which protects networks and end points thereof.

SUMMARY OF THE INVENTION

The present invention describes a system and method to deliverexecutables to network endpoints in a secure manner from an appliance soas to protect the network from potentially malicious executable files.The appliance of the present invention acts as a gateway where it cansniff all the network traffic, analyze the traffic and prevent externalthreats which could infect local systems. All executable applications,both known and unknown, are wrapped in a protective manner beforedelivery to a client system or end point. With the present invention,threats are run in a sandbox environment in client systems and behavioranalysis is performed while the threats are running.

The present invention is a system for protecting a network fromexecutables which comprises a network appliance having an interceptorthat receives network traffic from a network and analyzes the networktraffic for any and all executable application(s). The system has apacker which produces a wrapped executable application by wrapping theexecutable application and a data transmission connection to deliver thewrapped executable application to a client system. The client systemincludes at least one computer or handheld device connected to thenetwork with the wrapped executable application running in a sandbox onthe client system.

The system for protecting a network further includes an embodiment whereat least one predefined policy or rule or rule set is applied to thenetwork traffic to separate an unknown executable application, with thepacker then wrapping only the unknown executable application to producethe wrapped executable application. The system of the present inventionprovides for behavior analysis to be performed on the wrapped executableapplication in said sandbox. In this way, any suspicious behaviour canbe determined and the network, along with the end points, is made moresecure and protected.

With the system of the present invention, the wrapping of the executableapplication(s) includes a sandbox and the executable application(s) isplaced inside the sandbox to produce the wrapped executable application.The wrapping can also include providing at least one executable scriptwith the executable application and delivering the at least oneexecutable script with the executable application as the wrappedexecutable application. The system of the present invention then runsthe at least one executable script on the at least one computer orhandheld device of an end user.

In an embodiment of the system of the present invention wrapping theexecutable application includes determining if a sandbox exists on thecomputer or handheld device of an end user and then extracting theexecutable application from the wrapped application if a sandbox exists.In this case, the system sends only the executable application to thesandbox on the at least one computer or handheld device of the end user.

The present invention includes a network appliance which comprises aninterceptor for receiving network traffic and analyzes the networktraffic for executable applications or at least one executableapplication at a time. The network appliance also has a packer whichproduces a wrapped executable application by wrapping the executableapplications or at least one executable application, and a datatransmission connection to deliver the wrapped executable application toa network client system or an end point. The network appliance furtherincludes at least one predefined policy or rule or rule set applied tothe executable applications or at least one executable application toseparate an unknown executable application. The packer then wraps onlythe unknown executable application to produce the wrapped executableapplication which is delivered to the client system or end point.

In the network appliance of the present invention, the wrapping includesa sandbox and at least one executable application is placed inside thesandbox to produce the wrapped executable application. In the networkappliance of the present invention, in an embodiment, the wrappingincludes providing at least one executable script with the at least oneexecutable application and delivering the at least one executable scriptwith the at least one executable application as the wrapped executableapplication. The at least one executable script is run on a computer orhandheld device of an end user.

Further, the network appliance of the present invention includes anembodiment wherein wrapping the at least one executable applicationincludes determining if a sandbox exists on a computer or handhelddevice of an end user and extracting the at least one executableapplication from the wrapped application if a sandbox exists. In thisembodiment, the network appliance sends only the at least one executableapplication to the sandbox on the computer or handheld device of the enduser.

The present invention includes a method to protect end points of anetwork which comprises monitoring network traffic of a network andextracting at least one executable application from the network traffic.The method then wraps the at least one executable application and sendsthe wrapped executable application to an end user of the network. Themethod further includes identifying an unknown executable applicationbased on at least one rule or policy after extracting at least oneexecutable application from the network traffic. The method then wrapsthe unknown executable application and sends the wrapped unknownexecutable application to an end user of the network.

In the method of the present invention, the wrapping step includesplacing the at least one executable application inside a sandbox anddelivering the at least one executable application and the sandbox tothe end user. In an embodiment, the wrapping step comprises including atleast one executable script with the at least one executable applicationand delivering the at least one executable script with the at least oneexecutable application to the end user. Then, running the at least oneexecutable script on a computer or handheld device of the end user.

The present invention also includes a method to protect a network. Thiscomprises monitoring the network traffic of a network and wrapping atleast one executable application found within and on the networktraffic. The method of protecting a network then determines if a sandboxexists on a computer or handheld device of an end user and, if a sandboxexists, then extracting the at least one executable application from thewrapped application and sending only the at least one executableapplication to the sandbox on the computer or handheld device of the enduser.

The method further includes an embodiment of identifying an unknownexecutable application based on at least one policy after monitoringnetwork traffic and wrapping the unknown executable application. Themethod again determines if a sandbox exists on the end point, and if so,the unknown executable application is extracted from the wrapped unknownexecutable application. In this embodiment, the method sends only theunknown executable application to the sandbox on the computer orhandheld device of the end user via data transmission connection.

The present invention also includes a method to protect an end user of anetwork where an agent or piece of malware already exists on the enduser's device and is waiting to be activated by a second file orcode(s). The method comprises monitoring network traffic of the networkand sending an alert to the end user to run an executable application ina sandbox. Then, the method sends the executable application to acomputer or handheld device of an end user and prevents the executableapplication from communicating instructions with an agent which existson the computer or handheld device of the end user.

The method further includes identifying an unknown executableapplication based on at least one rule or policy after the step ofmonitoring network traffic and sending an alert to the end user to runthe unknown executable application in a sandbox. Then the unknownexecutable application is sent to a computer or handheld device of anend user, which can be run in a sandbox. Thereby, the method preventsthe unknown executable application from communicating instructions withan agent which exists on the computer or handheld device of the enduser.

The method to securely deliver executables to an endpoint includesmonitoring network traffic, extracting executable applications from thenetwork traffic, identifying an unknown executable application based ona set of rules or policies, wrapping the unknown executable applicationand sending the wrapped unknown executable application to an end useroperating a computer or handheld device as the endpoint. By wrapping theunknown application prior to delivery to a client system and hence endpoints, the unknown application is securely delivered to an end pointwithout infecting the local system.

In the method of the invention, the wrapping step includes placing theunknown executable application inside a sandbox and delivering theunknown executable application and the sandbox to the end user.

In an embodiment of the invention, the wrapping step comprises theinclusion of at least one or more executable scripts with the unknownexecutable application and delivering the at least one or moreexecutable scripts with the unknown executable application to the enduser. The at least one or more executable scripts are then run on acomputer or handheld device of the end user.

The present invention provides a method to securely deliver executablesto an endpoint which includes monitoring network traffic, identifying anunknown executable application based on a set of rules or policies,wrapping the unknown executable application. In this embodiment, theinvention determines if a sandbox exists on a computer or handhelddevice of an end user and then extracts the unknown executableapplication from the wrapped application if a sandbox exists. The methodthen sends only the unknown executable application to the sandbox on thecomputer or handheld device of the end user. In this manner, the size ofthe files which are transmitted to the endpoint are reducedsignificantly.

The present invention also includes end point security where an existingsuspicious, malicious or information tracking agent is already on theend point and is awaiting instructions or activation by a second portionof code. The present invention can overcome this cybersecurity issue bya method to securely deliver executables to an end user by monitoringnetwork traffic and identifying an unknown executable application basedon a rule set or policies. The invention sends an alert or message tothe end user to run the unknown executable application in a sandbox. Theinvention sends the unknown executable application to a computer orhandheld device of an end user. Once at the end point, the inventionprevents the unknown executable application from communicatinginstructions with an existing agent on the computer or handheld deviceof the end user which is a malicious, suspicious, or informationtracking agent. This could include various viruses, malware, widgets,beacons, trackers, botnets, malvertising networks (malicious advertisingnetworks), codes, scripts, multimedia content files or any other file orcode which could be activated by or receive instructions from a secondfile or code.

The present invention includes a network appliance. The appliance has aninterceptor which receives network traffic, such as internet, http/httpsdownloads, email traffic and attachments, instant message transferringmessages. The interceptor analyzes the network traffic for executableapplications and a set of predefined rules or policies are applied tothe executable applications to separate any and all unknown executableapplication(s). The network appliance includes a packer, which producesa wrapped executable application by wrapping the unknown executableapplication and a data transmission connection to deliver the wrappedexecutable application to an endpoint on a client in a secure manner.

In the network appliance of the present invention, the wrapping includesa sandbox and the unknown executable application is placed inside thesandbox to produce the wrapped executable application.

In an embodiment of the network appliance of the present invention, thewrapping includes providing at least one or more executable scripts withthe unknown executable application. The at least one or more executablescripts are delivered with the unknown executable application as thewrapped executable application. The at least one or more executablescripts are then run on a computer or handheld device of an end user.

The network appliance of the present invention also has an embodimentwhere wrapping the unknown executable application includes determiningif a sandbox exists on a computer or handheld device of an end user. Ifa sandbox already exists, the unknown executable application isextracted from the wrapped application, and then the present inventionsends only the unknown executable application to the sandbox on thecomputer or handheld device of the end user.

The present invention also includes a system for securely deliveringexecutables to an endpoint. The system comprises a network appliance anda client system. The network appliance has an interceptor which receivesnetwork traffic from a network and analyzes the network traffic forexecutable applications. The system applies a set of predefined policiesor rules applied to the executable applications to separate each unknownexecutable application. A packer then produces a wrapped executableapplication by wrapping the unknown executable application. The networkappliance of the system of the present invention has a connection fordata transmission to deliver the wrapped executable application to aclient system. The client system includes a computer network andcomprises at least one computer or handheld device connected to thenetwork, normally receiving internet, web traffic, and email traffic.The wrapped executable application is run in a sandbox on the clientsystem. The system of the present invention includes behavior analysisperformed on the wrapped executable application in the sandbox.

In the system of the present invention, the wrapping of the unknownexecutable application includes a sandbox and the unknown executableapplication is placed inside the sandbox to produce the wrappedexecutable application.

The system of the present invention also provides for the wrapping ofthe unknown executable applications to include providing at least one ormore executable scripts with the unknown executable application. The oneor multiple executable scripts are delivered with the unknown executableapplication as the wrapped executable application. The at least one ormore executable scripts are then run on the at least one computer orhandheld device of the end user.

The system of the present invention includes an embodiment wherewrapping the unknown executable application is accomplished by firstdetermining if a sandbox exists on a computer or handheld device of anend user. If a sandbox exists, the unknown executable application isextracted from the wrapped application and only the unknown executableapplication is sent to the sandbox on the at least one computer orhandheld device of the end user.

The present invention and method has several advantages and features.The present invention is an effective protection against zero-dayattacks and advanced persistent threats. With the present invention, theanalysis is performed in the client systems, which reduces the workloadof the appliance. Additionally, unlike a virtual machine solution, itcannot be bypassed by virtual machine detection. By executing threats inthe client system, the present invention can retrieve the threat'sprecise and actual behavior(s). Further, by analyzing threats whileusing them, the invention provides a seamless user experience. Anotherfeature of the present invention is that even if the analyzer of thepresent invention fails to detect threats, no intrusion happens inclient systems because the threats are running in a sandbox environment.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic of the method and appliance of the presentinvention.

FIG. 2 is a schematic of the packer tool wrapping an application.

FIG. 3 is a flowchart of the wrapper.

FIG. 4(a) is a schematic of a wrapping method of the present invention.

FIG. 4(b) is a schematic of a wrapping method of the present invention.

FIG. 4(c) is a schematic of a wrapping method of the present invention.

FIG. 5 is an alternate embodiment of the present invention.

FIG. 6 is a schematic of the memory and hardware of a computer orhandheld device, such as a tablet or smartphone.

FIG. 7 is a schematic of an individual user operating a computer orhandheld device connected to the internet.

FIG. 8 illustrates computer devices and components thereof.

DETAILED DESCRIPTION

When a user browses the internet or opens emails and attachments withtheir computer or handheld device, the users are also opening themselvesand their computers, devices, and systems to numerous cybersecurityrisks, such as malware, viruses, and phishing attacks to identify only afew. The present invention enhances the user's cybersecurity andovercomes the disadvantages of prior solutions mentioned previously. Inthe present invention, there is provided a network appliance forintercepting web and email traffic and downloads, then extractingexecutables, comparing them with a policy and wrapping it. Then, thewrapped executables are delivered to a client system where they run in asandbox with all file system, registry accesses, communication andtraffic isolated.

Referring to FIG. 1, the system and process of the present invention 10is shown. The system and process includes an appliance 20 incommunication with a client system 40. Within the appliance process,internet 22 and web traffic 24 are intercepted by interceptor function26 which extracts the executable files 28 from the traffic 24. Theexecutable files 28 are compared with policies 30 to identify suspiciousexecutable files(s) 32. These suspicious executable file(s) 32 are sentto a packer tool 34 which wraps the suspicious executable 32 to create awrapped executable 36 which can be delivered to the client system 40.The wrapped executable 36 is run inside a sandbox 42 at the clientsystem 40. At this time, behavior analysis 44 of the wrapped files 36 isalso performed. This is stored at isolated storage area 46, separatefrom communication and email or internet traffic on the client system40.

Interceptor:

By monitoring web access and traffic, the appliance 20 of the presentinvention 10 extracts executable files from an HTTP/HTTPS downloadrequest, email traffic and IM transferring messages. At least one orvarious policies or rule sets (e.g. digital signatures, file sources,file attributes, etc.) are used to determine whether they should bewrapped. All potential suspicious executables are sent to the packertool for sandbox wrapping. Additionally, all of the executables can besent to the packing tool for wrapping.

Referring to FIG. 2, there is shown the packing process 60 used with thepresent invention. The packing process 60 includes a wrapper or wrappingfunction 62, a target application 64 having unknown executable files.The target application 64 includes an icon 66 and a user account controlmanifest 68. The process includes a packer 70 to pack the targetapplication 64 and wrapper 62 together, creating wrapped application 72with overlay icon 74.

Packer:

The packer is a tool to generate the wrapped application. It takes thefollowing parameters as input when wrapping an application: 1.) downloadlocation to get Sandbox installer if it is not installed—this locationcan be either a file server or remote HTTP/HTTPS server; 2.) the path ofthe target application which will be wrapped; and 3.) a wrapperapplication which performs the main logic of the wrapper.

The process for a packer to wrap an application is as follows and alsoshown in FIG. 2. First, the packer 70 embeds a target application 64into the wrapper 62 as a resource with fixed resource identification.Next, the packer extracts the icon 66 of the target application 64, andadds an overlay icon 74 to indicate that it is secured by the sandboxand then applies it to wrapper. Next, the packer extracts the useraccount control (UAC) manifest 68 of the target application 64 andapplies it to the wrapper 62 so that the wrapped application 72 has sameUAC behavior with the target application 64. In order to make the packer70 independent of platforms, resource changes are performed by rawbinary modification without using resource API of Windows SDK.

Wrapper:

The wrapper sets up a sandbox environment and runs the targetapplication in the sandbox. As shown in FIG. 3, the wrapper process 100works in the following manner: First, when the wrapper starts, it checksfor a sandbox installation 110. If sandbox is not installed, the wrappergets the sandbox installer from a predefined location 112 (describedabove) and installs it with a certain configuration 114. A progress baris displayed to show the entire progress of downloading andinstallation. If there is a problem with downloading or installation116, the wrapper will simply exit 118, thus the application will not runin this case. When the sandbox environment is ready 120, it extracts theexecutable file(s) from the resource 122, drops it on a disk 124 and runit in the sandbox using a sandbox launcher, e.g. sblauncher.exe [path ofdropped app] 126. The wrapper finally removes the dropped executablewhen it exits 128.

The system and process of wrapping can occur in different methods.First, as described and shown in FIG. 4(a), the wrapping 200 isaccomplished by placing the application 204 inside the sandbox 202 anddelivering the entire package (sandbox 202 and application 204) to theclient system/endpoint 206. In FIG. 4(b), there is shown a second methodof wrapping 220 which includes at least one or more executable script(s)224 with the unknown application 222, both of which are then deliveredto the client system/endpoint 226. In this manner, when the application222 with the script(s) 224 lands on the endpoint 226, such as the user'scomputer or handheld device, the executable scripts 224 can be run. InFIG. 4(c), a third method of wrapping 230 is disclosed if there isalready a sandbox 236 on the endpoint 234. If the end user already has asandbox application 236 on their device or computer, the presentinvention can send only the unknown application file 232 to the sandbox236 in order to conserve data and space while securely delivering theunknown file 232.

With the present invention, an alternative embodiment 300 is shown inFIG. 5 where the appliance identifies an executable file or even asuspicious portion of a file 32 and sends an alert 320 to the clientsystem to run the executable file in a sandbox 42. This is particularlycritical for security of the endpoint if an agent or agents 310 arecurrently running or exist on the client system already and the secondfile 32 is code which sends instructions 330 to the agent. With themonitor sending the alert 320 to run the file in a sandbox, it preventsthe instructions 330 from the second file 32 reaching the maliciousagent 310. A wrapper is not necessary if there is a sandbox on a system.

Sandbox:

During the sandboxing process, file system modifications (includingcreation, deletion, write, and rename) are redirected to an isolatedstorage area. Similarly, registry modifications (including key/valuecreation and deletion) are redirected to an isolated storage area.Additionally, all communication between the sandboxed application andthe outside application is blocked, for example, process open, DCOM/RPCcommunication, etc.

Behavior Analysis:

The present invention also performs behaviour analysis while threats arerunning. For behaviour analysis of the files, all potential suspiciousand dangerous behaviours are recorded and analysed. This includes: 1.)process creation and termination; 2.) file system changes; 3.) registrychanges; 4.) URL access and DNS query; 5.) inter-process communication;and 6.) named objects creation.

The system and method of the present invention may be used with computersystems and devices as shown in FIGS. 6 and 7. FIG. 6 illustrates asystem 500 of a computer or device which includes a microprocessor 520and a memory 540 which are coupled to a processor bus 560 which iscoupled to a peripheral bus 600 by circuitry 580. The bus 600 iscommunicatively coupled to a disk 620. It should be understood that anynumber of additional peripheral devices are communicatively coupled tothe peripheral bus 600 in embodiments of the invention. Further, theprocessor bus 560, the circuitry 580 and the peripheral bus 600 composea bus system for computing system 500 in various embodiments of theinvention. The microprocessor 520 starts disk access commands to accessthe disk 620. Commands are passed through the processor bus 560 via thecircuitry 580 to the peripheral bus 600 which initiates the disk accesscommands to the disk 620. In various embodiments of the invention, thepresent system intercepts the disk access commands which are to bepassed to the hard disk.

As shown generally by FIG. 7, there is a user 1000 of a computer 1010 orhandheld device 1012 who accesses an Internet website 1020 with networkconnections to a server 1050 and database 1040. The computer 1010 orhandheld device is compatible with operating systems known in the art,such as Windows, iOS or android devices or android type operatingsystems. The user 1000 is potentially exposed to many malicious orunsafe applications located on the web or a particular website 1020 dueto lack of security and validation with the source, even though thewebsite 1020 itself may be known as reliable and trusted. The websitemay be an application store or directory which includes other softwareapplications for downloading. Similarly, receiving email may introduceunsafe internet links, applications and attachments to the user'scomputer or device. Those of skill in the art would recognize that thecomputer 1010 or hand held devices 1012 a or 1012 b each has a processorand a memory coupled with the processor where the memory is configuredto provide the processor with executable instructions. A boot disk 1030is present for initiating an operating system as well for each of thecomputer 1010 or hand held devices 1012. It should also be noted that asused herein, the term handheld device includes phones, smart phones,tablets, personal digital assistants, media and game players and thelike. It should also be understood that the user's computer or devicemay be part of an internal network or system which is communicating withthe Internet. As used throughout the specifications, the term “query” or“queries” is used in the broadest manner to include requests, polls,calls, summons, queries, and like terms known to those of skill in theart.

FIG. 8 shows an example of a generic computer device 1400 and a genericmobile computer device 1450, which may be used to implement theprocesses described herein, including the mobile-side and server-sideprocesses for installing a computer program from a mobile device to acomputer. Computing device 1400 is intended to represent various formsof digital computers, such as laptops, desktops, workstations, personaldigital assistants, servers, blade servers, mainframes, and otherappropriate computers. Computing device 1450 is intended to representvarious forms of mobile devices, such as personal digital assistants,cellular telephones, smartphones, and other similar computing devices.The components shown here, their connections and relationships, andtheir functions, are meant to be exemplary only, and are not meant tolimit implementations of the inventions described and/or claimed in thisdocument.

Computing device 1400 includes a processor 1402, memory 1404, a storagedevice 1406, a high-speed interface 1408 connecting to memory 1404 andhigh-speed expansion ports 1410, and a low speed interface 1412connecting to low speed bus 1414 and storage device 1406. Each of thecomponents 1402, 1404, 1406, 1408, 1410, and 1412 are interconnectedusing various busses, and may be mounted on a common motherboard or inother manners as appropriate. The processor 1402 can processinstructions for execution within the computing device 1400, includinginstructions stored in the memory 1404 or on the storage device 1406 todisplay graphical information for a GUI on an external input/outputdevice, such as display 1416 coupled to high speed interface 1408. Inother implementations, multiple processors and/or multiple busses may beused, as appropriate, along with multiple memories and types of memory.Also, multiple computing devices 1400 may be connected, with each deviceproviding portions of the necessary operations (e.g., as a server bank,a group of blade servers, or a multi-processor system).

The memory 1404 stores information within the computing device 1400. Inone implementation, the memory 1404 is a volatile memory unit or units.In another implementation, the memory 1404 is a non-volatile memory unitor units. The memory 1404 may also be another form of computer-readablemedium, such as a magnetic or optical disk.

The storage device 1406 is capable of providing mass storage for thecomputing device 1400. In one implementation, the storage device 1406may be or contain a computer-readable medium, such as a floppy diskdevice, a hard disk device, an optical disk device, or a tape device, aflash memory or other similar solid state memory device, or an array ofdevices, including devices in a storage area network or otherconfigurations. A computer program product can be tangibly embodied inan information carrier. The computer program product may also containinstructions that, when executed, perform one or more methods, such asthose described above. The information carrier may be a non-transitorycomputer- or machine-readable storage medium, such as the memory 1404,the storage device 1406, or memory on processor 1402.

The high speed controller 1408 manages bandwidth-intensive operationsfor the computing device 1400, while the low speed controller 1412manages lower bandwidth-intensive operations. Such allocation offunctions is exemplary only. In one implementation, the high-speedcontroller 1408 is coupled to memory 1404, display 1416 (e.g., through agraphics processor or accelerator), and to high-speed expansion ports1410, which may accept various expansion cards (not shown). In theimplementation, low-speed controller 1412 is coupled to storage device1406 and low-speed expansion port 1414. The low-speed expansion port1414, which may include various communication ports (e.g., USB,Bluetooth, Ethernet, wireless Ethernet), may be coupled to one or moreinput/output devices, such as a keyboard, a pointing device, a scanner,or a networking device such as a switch or router, e.g., through anetwork adapter.

The computing device 1400 may be implemented in a number of differentforms, as shown in the figure. For example, it may be implemented as astandard server 1420, or multiple times in a group of such servers. Itmay also be implemented as part of a rack server system ix) 1424. Inaddition, it may be implemented in a personal computer such as a laptopcomputer 1422. Alternatively, components from computing device 1400 maybe combined with other components in a mobile device (not shown), suchas device 1450. Each of such devices may contain one or more ofcomputing device 1400, 1450, and an entire system may be made up ofmultiple computing devices 1400, 1450 communicating with each other.

Computing device 1450 includes a processor 1452, memory 1464, aninput/output device such as a display 1454, a communication interface1466, and a transceiver 1468, among other components. The device 1450may also be provided with a storage device, such as a microdrive orother device, to provide additional storage. Each of the components1450, 1452, 1464, 1454, 1466, and 1468 are interconnected using variousbusses, and several of the components may be mounted on a commonmotherboard or in other manners as appropriate.

The processor 1452 can execute instructions within the computing device1450, including instructions stored in the memory 1464. The processormay be implemented as a chipset of chips that include separate andmultiple analog and digital processors. The processor may provide, forexample, for coordination of the other components of the device 1450,such as control of user interfaces, applications run by device 1450, andwireless communication by device 1450.

Processor 1452 may communicate with a user through control interface1458 and display interface 1456 coupled to a display 1454. The display1454 may be, for example, a TFT LCD (Thin-Film-Transistor Liquid CrystalDisplay) or an OLED (Organic Light Emitting Diode) display, or otherappropriate display technology. The display interface 1456 may compriseappropriate circuitry for driving the display 1454 to present graphicaland other information to a user. The control interface 1458 may receivecommands from a user and convert them for submission to the processor1452. In addition, an external interface 1462 may be provided incommunication with processor 1452, so as to enable near areacommunication of device 1450 with other devices. External interface 1462may provide, for example, for wired communication in someimplementations, or for wireless communication in other implementations,and multiple interfaces may also be used.

The memory 1464 stores information within the computing device 1450. Thememory 1464 can be implemented as one or more of a computer-readablemedium or media, a volatile memory unit or units, or a non-volatilememory unit or units. Expansion memory 1474 may also be provided andconnected to device 1450 through expansion interface 1472, which mayinclude, for example, a SIMM (Single In Line Memory Module) cardinterface. Such expansion memory 1474 may provide extra storage spacefor device 1450, or may also store applications or other information fordevice 1450. Specifically, expansion memory 1474 may includeinstructions to carry out or supplement the processes described above,and may include secure information also. Thus, for example, expansionmemory 1474 may be provide as a security module for device 1450, and maybe programmed with instructions that permit secure use of device 1450.In addition, secure applications may be provided via the SIMM cards,along with additional information, such as placing identifyinginformation on the SIMM card in a non-hackable manner.

The memory may include, for example, flash memory and/or NVRAM memory,as discussed below. In one implementation, a computer program product istangibly embodied in an information carrier. The computer programproduct contains instructions that, when executed, perform one or moremethods, such as those described above. The information carrier is acomputer- or machine-readable medium, such as the memory 1464, expansionmemory 1474, memory on processor 1452, or a propagated signal that maybe received, for example, over transceiver 1468 or external interface1462.

Device 1450 may communicate wirelessly through communication interface1466, which may include digital signal processing circuitry wherenecessary. Communication interface 1466 may provide for communicationsunder various modes or protocols, such as GSM voice calls, SMS, EMS, orMMS messaging, CDMA, TDMA, PDC, WCDMA, CDMA2000, or GPRS, among others.Such communication may occur, for example, through radio-frequencytransceiver 1468. In addition, short-range communication may occur, suchas using a Bluetooth, Wi-Fi, or other such transceiver (not shown). Inaddition, GPS (Global Positioning System) receiver module 1470 mayprovide additional navigation- and location-related wireless data todevice 1450, which may be used as appropriate by applications running ondevice 1450.

Device 1450 may also communicate audibly using audio codec 1460, whichmay receive spoken information from a user and convert it to usabledigital information. Audio codec 1460 may likewise generate audiblesound for a user, such as through a speaker, e.g., in a handset ofdevice 1450. Such sound may include sound from voice telephone calls,may include recorded sound (e.g., voice messages, music files, etc.) andmay also include sound generated by applications operating on device1450.

The computing device 1450 may be implemented in a number of differentforms, as shown in the figure. For example, it may be implemented as acellular telephone 1480. It may also be implemented as part of asmartphone 1482, personal digital assistant, or other similar mobiledevice.

Various implementations of the systems and techniques described here canbe realized in digital electronic circuitry, integrated circuitry,specially designed ASICs (application specific integrated circuits),computer hardware, firmware, software, and/or combinations thereof.These various implementations can include implementation in one or morecomputer programs that are executable and/or interpretable on aprogrammable system including at least one programmable processor, whichmay be special or general purpose, coupled to receive data andinstructions from, and to transmit data and instructions to, a storagesystem, at least one input device, and at least one output device.

These computer programs (also known as programs, software, softwareapplications or code) include machine instructions for a programmableprocessor, and can be implemented in a high-level procedural and/orobject-oriented programming language, and/or in assembly/machinelanguage. As used herein, the terms “machine-readable medium” or“computer-readable medium” refers to any computer program product,apparatus and/or device (e.g., magnetic discs, optical disks, memory,Programmable Logic Devices (PLDs)) used to provide machine instructionsand/or data to a programmable processor, including a machine-readablemedium that receives machine instructions as a machine-readable signal.The “computer readable storage medium” may be any tangible medium (butnot a signal medium—which is defined below) that can contain, or store aprogram. The terms “machine readable medium,” “computer-readablemedium,” or “computer readable storage medium” are all referencingnon-transitory mediums in their nature and definition.

The term “machine-readable signal” refers to any signal used to providemachine instructions and/or data to a programmable processor. A“computer readable signal medium” may be any computer readable mediumthat is not a computer readable storage medium and that can communicate,propagate, or transport a program.

To provide for interaction with a user, the systems and techniquesdescribed here can be implemented on a computer having a display device(e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor)for displaying information to the user and a keyboard and a pointingdevice (e.g., a mouse or a trackball) by which the user can provideinput to the computer. Other kinds of devices can be used to provide forinteraction with a user as well; for example, feedback provided to theuser can be any form of sensory feedback (e.g., visual feedback,auditory feedback, or tactile feedback); and input from the user can bereceived in any form, including acoustic, speech, or tactile input.

The systems and techniques described here can be implemented in acomputing system that includes a back end component (e.g., as a dataserver), or that includes a middleware component (e.g., an applicationserver), or that includes a front end component (e.g., a client computerhaving a graphical user interface or a Web browser through which a usercan interact with an implementation of the systems and techniquesdescribed here), or any combination of such back end, middleware, orfront end components. The components of the system can be interconnectedby any form or medium of digital data communication (e.g., acommunication network). Examples of communication networks include alocal area network (“LAN”), a wide area network (“WAN”), and theInternet.

The computing system can include clients and servers. A client andserver are generally remote from each other and typically interactthrough a communication network. The relationship of client and serverarises by virtue of computer programs running on the respectivecomputers and having a client-server relationship to each other.

A number of implementations have been described. Nevertheless, it willbe understood that various modifications may be made without departingfrom the spirit and scope of the invention.

In addition, the logic flows depicted in the figures do not require theparticular order shown, or sequential order, to achieve desirableresults. In addition, other steps may be provided, or steps may beeliminated, from the described flows, and other components may be addedto, or removed from, the described systems. Accordingly, otherimplementations are within the scope of the following claims.

Elements of different implementations described herein may be combinedto form other implementations not specifically set forth above. Elementsmay be left out of the processes, computer programs, Web pages, etc.described herein without adversely affecting their operation.Furthermore, various separate elements may be combined into one or moreindividual elements to perform the functions described herein.

The invention is not restricted to the details of the foregoingembodiments. The invention extends to any novel one, or any novelcombination, of the features disclosed in this specification (includingany accompanying claims, abstract and drawings), or to any novel one, orany novel combination, of the steps of any method or process sodisclosed.

What is claimed is:
 1. A system for protecting a network comprising: anetwork appliance having an interceptor and a packer, said interceptorreceives network traffic from a network and analyzes said networktraffic for any executable application; said network appliance having atleast one predefined policy applied to said network traffic to separatea target executable application from said any executable application;said packer produces a wrapped executable application by wrapping onlythe target executable application, said target executable applicationhaving an icon and a user account control manifest; said packerembedding said target executable application into a wrapper as aresource with a fixed resource identification and said packer extractingsaid icon of said target executable application; said packer adding anoverlay icon to said target executable application and applying saidoverlay icon to said wrapper; said packer extracts said user accountcontrol manifest of said target executable application and applying saiduser account control manifest to said wrapper; said packer madeindependent of platforms by performing resource changes by raw binarymodification without using resource API of Windows SDK; a client systemcomprising at least one computer or handheld device connected to saidnetwork; a data transmission connection to deliver said wrappedexecutable application to said client system; said wrapped executableapplication running in a sandbox on said client system wherein behavioranalysis is performed on said wrapped executable application in saidsandbox.
 2. The system of claim 1 wherein said packer which produces awrapped executable application by wrapping of the target executableapplication includes a sandbox and the target executable application isplaced inside the sandbox to produce the wrapped executable application.3. The system of claim 1, wherein said packer which produces a wrappedexecutable application by wrapping includes at least one executablescript provided with the target executable application; and the at leastone executable script is delivered with the target executableapplication as the wrapped executable application.
 4. The system ofclaim 3, wherein said at least one executable script is run on the atleast one computer or handheld device.
 5. The system of claim 1, whereinsaid packer which produces a wrapped executable application by wrappingthe target executable application includes: said packer determining if asandbox exists on a computer or handheld device; and extracting thetarget executable application from the wrapped application if a sandboxexists; said network appliance sending only the target executableapplication to the sandbox on the at least one computer or handhelddevice.
 6. A network appliance comprising: an interceptor and a packer,said interceptor receives network traffic and analyzes said networktraffic for at least one executable application; at least one predefinedpolicy applied to said at least one executable application to separatean unknown executable application; said packer produces a wrappedexecutable application by wrapping only the unknown executableapplication to produce the wrapped executable application; said unknownexecutable application having an icon and a user account controlmanifest; said packer embedding said unknown executable application intoa wrapper as a resource with a fixed resource identification and saidpacker extracting said icon of said unknown executable application; saidpacker adding an overlay icon to said unknown executable application andapplying said overlay icon to said wrapper; said packer extracts saiduser account control manifest of said unknown executable application andapplying said user account control manifest to said wrapper; said packermade independent of platforms by performing resource changes by rawbinary modification without using resource API of Windows SDK; a datatransmission connection to deliver said wrapped executable applicationwherein behavior analysis is performed on said wrapped executableapplication in a sandbox.
 7. The network appliance of claim 6, whereinthe packer includes a sandbox and the unknown executable application isplaced inside the sandbox to produce the wrapped executable application.8. The network appliance of claim 6, wherein the packer includes atleast one executable script provided with the unknown executableapplication; and the at least one executable script is delivered withthe unknown executable application as the wrapped executableapplication.
 9. The network appliance of claim 8, wherein said at leastone executable script is run on a computer or handheld device of an enduser.
 10. The network appliance of claim 6, wherein said packer whichproduces a wrapped executable application by wrapping the unknownexecutable application includes: said packer determining if a sandboxexists on a computer or handheld device; and extracting the unknownexecutable application from the wrapped application if a sandbox exists;said network appliance sending only the unknown executable applicationto the sandbox on the computer or handheld device.
 11. A method toprotect end points of a network comprising: monitoring network trafficof a network; extracting at least one executable application from saidnetwork traffic; identifying an unknown executable application based onat least one rule after extracting said at least one executableapplication from said network traffic, said unknown executableapplication having an icon and a user account control manifest; wrappingthe unknown executable application by a packer which is made independentof platforms by performing resource changes by raw binary modificationwithout using resource API of Windows SDK; embedding, by said packer,said unknown executable application into a wrapper as a resource with afixed resource identification; extracting said icon of said unknownexecutable application by said packer; adding an overlay icon by saidpacker to said unknown executable application; applying said overlayicon to said wrapper; extracting by said packer said user accountcontrol manifest of said unknown executable application applying saiduser account control manifest to said wrapper; sending the wrappedunknown executable application to an end user of the network performingbehavior analysis on said wrapped unknown executable application in asandbox.
 12. The method of claim 11, wherein the wrapping step includes:placing the unknown executable application inside a sandbox anddelivering the unknown executable application and the sandbox to the enduser.
 13. The method of claim 11, wherein the wrapping step comprises:including at least one executable script with the unknown executableapplication; delivering the at least one executable script with theunknown executable application to the end user; running the at least oneexecutable script on a computer or handheld device of the end user. 14.A method to protect a network comprising: monitoring network emailtraffic of a network; wrapping at least one executable application fromsaid email traffic by a packer which is made independent of platforms byperforming resource changes by raw binary modification without usingresource API of Windows SDK; determining if a sandbox exists on acomputer or handheld device of an end user; extracting the at least oneexecutable application from the wrapped application if a sandbox exists;sending only the at least one executable application to the sandbox onthe computer or handheld device of the end user.
 15. The method of claim14 further comprising: identifying an unknown executable applicationbased on at least one policy after the step of monitoring network emailtraffic; wrapping the unknown executable application; extracting theunknown executable application from the wrapped unknown executableapplication if a sandbox exists; sending only the unknown executableapplication to the sandbox on the computer or handheld device of the enduser.
 16. A method to securely deliver executables to an endpointcomprising: monitoring network traffic; identifying an unknownexecutable application based on at least one policy; wrapping theunknown executable application by a packer which is made independent ofplatforms by performing resource changes by raw binary modificationwithout using resource API of Windows SDK; determining if a sandboxexists on a computer or handheld device of an end user; extracting theunknown executable application from the wrapped application if a sandboxexists; sending only the unknown executable application to the sandboxon the computer or handheld device of the end user.
 17. A method tosecurely deliver executables to an end user comprising: monitoringnetwork traffic; identifying an unknown executable application based onat least one rule; wrapping the unknown executable application by apacker which is made independent of platforms by performing resourcechanges by raw binary modification without using resource API of WindowsSDK; sending an alert to the end user to run the unknown executableapplication in a sandbox; sending the unknown executable application toa computer or handheld device of an end user, preventing the unknownexecutable application from communicating instructions with an agentexisting on the computer or handheld device of the end user.
 18. Anetwork appliance comprising: an interceptor which receives networktraffic and analyzes said network traffic for executable applications;at least one predefined policy applied to said executable applicationsto separate an unknown executable application; a packer which produces awrapped executable application by wrapping the unknown executableapplication; said network appliance determining if a sandbox exists on acomputer or handheld device and extracts the unknown executableapplication from the wrapped application if a sandbox exists; a datatransmission connection to deliver said wrapped executable applicationor deliver only the unknown executable application if said sandboxexists on said computer or handheld device.
 19. The network appliance ofclaim 18, wherein the wrapping includes a sandbox and the unknownexecutable application is placed inside the sandbox to produce thewrapped executable application.
 20. The network appliance of claim 18,wherein the wrapping includes providing at least one executable scriptwith the unknown executable application; delivering the at least oneexecutable script with the unknown executable application as the wrappedexecutable application.
 21. The network appliance of claim 20, whereinsaid at least one executable script is run on a computer or handhelddevice of an end user.
 22. A system for securely delivering executablesto an endpoint comprising: a network appliance having an interceptorwhich receives network traffic from a network and analyzes said networktraffic for executable applications; at least one predefined policyapplied to said executable applications to separate an unknownexecutable application; a packer which produces a wrapped executableapplication by wrapping the unknown executable application; said networkappliance determining if a sandbox exists on a computer or handhelddevice and extracts the unknown executable application from the wrappedapplication if a sandbox exists; a data transmission connection todeliver only said unknown executable application to a client system;said client system comprising said computer or handheld device connectedto said network; said unknown executable application running in asandbox on said client system and behaviour analysis is performed onsaid unknown executable application in said sandbox.
 23. The system ofclaim 22 wherein the wrapping of the unknown executable applicationincludes a sandbox and the unknown executable application is placedinside the sandbox to produce the wrapped executable application. 24.The system of claim 22, wherein the wrapping includes providing at leastone executable script with the unknown executable application;delivering the at least one executable script with the unknownexecutable application as the wrapped executable application.
 25. Thesystem of claim 24, wherein said at least one executable script is runon the at least one computer or handheld device.